Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
697874 source statements · aliases may refer to the same vulnerabilityBackstage: Potential file exposure through local TechDocs publisher
cve-program ·
Vendor product: backstage · Vendor product: plugin-techdocs-node
Backstage: Scaffolder action input authorization bypass
cve-program ·
Vendor product: backstage · Vendor product: plugin-scaffolder-backend
Backstage: Improper URL validation in catalog entity placeholder resolution
cve-program ·
Vendor product: backstage · Vendor product: plugin-catalog-backend
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
cve-program ·
Vendor product: OpenSSH
Backstage: Improper preservation of access restrictions during service credential delegation
cve-program ·
Vendor product: backstage · Vendor product: backend-defaults
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
cve-program ·
Vendor product: backstage · Vendor product: plugin-kubernetes-backend
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
cve-program ·
Vendor product: OpenSSH
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
cve-program ·
Vendor product: backstage · Vendor product: plugin-auth-node
Backstage: Improper validation of MkDocs plugin configuration in TechDocs
cve-program ·
Vendor product: backstage · Vendor product: plugin-techdocs-node
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs
cve-program ·
Vendor product: lz4-java
Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass
cve-program ·
https://github.com/cri-o/cri-o: cri-o · https://access.redhat.com/downloads/content/package-browser/: cri-o · https://access.redhat.com/downloads/content/package-browser/: openshift/ose-rhel-coreos-8
Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information discl…
cve-program ·
Vendor product: Command | Configure (DCC)
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
cve-program ·
Vendor product: hydra
Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chromium security sever…
cve-program ·
Vendor product: Chrome
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
cve-program ·
Vendor product: liquidjs
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
cve-program ·
Vendor product: ImageSharp
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
cve-program ·
Vendor product: ImageSharp
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
cve-program ·
Vendor product: quasar
Payload: Uploaded XML files could execute same-origin JavaScript
cve-program ·
Vendor product: payload
Payload authentication token field handling issue
cve-program ·
Vendor product: payload
Payload: Remote Code Execution through first-register
cve-program ·
Vendor product: payload
Payload: Token refresh and password reset responses may expose restricted user fields
cve-program ·
Vendor product: payload
SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE
cve-program ·
Vendor product: SPIP Crayons Plugin
Payload: Insufficient Access Control in Stripe REST Proxy
cve-program ·
Vendor product: payload · Vendor product: plugin-stripe
SourceCodester Performance Indicator System view_product.php sql injection
cve-program ·
Vendor product: Performance Indicator System
Payload: Prototype pollution in Payload Import Export plugin
cve-program ·
Vendor product: payload · Vendor product: plugin-import-export
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated attacker with adjacent network access could potentially ex…
cve-program ·
Vendor product: Container Storage Modules
Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerabilit…
cve-program ·
Vendor product: Container Storage Modules (CSM)
openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation
cve-program ·
Vendor product: openapi-python-client
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Eleva…
cve-program ·
Vendor product: Container Storage Modules
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
cve-program ·
Vendor product: kiota · Vendor product: Microsoft.OpenApi.Kiota · Vendor product: Microsoft.OpenApi.Kiota.Builder
Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection
cve-program ·
Vendor product: UFO
Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs
cve-program ·
Vendor product: Mooncake
lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()
cve-program ·
Vendor product: lrzsz
Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection
cve-program ·
Vendor product: Learning-Management-System
PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint
cve-program ·
Vendor product: planka
SourceCodester Simple Student Information System searchresults.php clean cross site scripting
cve-program ·
Vendor product: Simple Student Information System
vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds
cve-program ·
Vendor product: vLLM
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
cve-program ·
Vendor product: Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.